An automated teller machine (ATM), also known as an automated banking machine (ABM) or Cash Machine is a computerized telecommunications device that provides the clients of a financial institution with access to financial transactions in a public space without the need for a cashier, human clerk or bank teller.
On most modern ATMs, the customer identifies himself by inserting a plastic ATM card with a magnetic stripe or a plastic smart card with a chip, which contains a unique card number and some security information. Authentication is achieved by the customer entering a personal identification number (PIN).
ATMs are placed not only near or inside the premises of banks, but also in locations such as shopping centers/malls, airports, grocery stores, petrol/gas stations, restaurants, or any place large numbers of people may gather. These represent two types of ATM installations: on and off premise. On-premise ATMs are typically more advanced, multi-function machines that complement an actual bank branch's capabilities and thus more expensive. Off-premise machines are deployed by financial institutions and also ISOs (or Independent Sales Organizations) where there is usually only a need for cash, so they typically are the cheaper mono-function devices. In North America, banks often have drive-thru lanes providing access to ATMs.
An ATM typically includes a CPU (to control the user interface and transaction devices), a magnetic and/or Chip card reader (to identify the customer), a PIN Pad often manufactured as part of a secure enclosure, a Secure crypto-processor, generally within a secure enclosure, a Display (used by the customer for performing the transaction), Function key buttons (usually close to the display) or a Touchscreen (used to select the various aspects of the transaction), a Record Printer (to provide the customer with a record of their transaction), a Vault (to store the parts of the machinery requiring restricted access), and a Housing (for aesthetics and to attach signage to).
Encryption of personal information, required by law in many jurisdictions, is used to prevent fraud. Sensitive data in ATM transactions are usually encrypted with DES, but transaction processors now usually require the use of Triple DES. Remote Key Loading techniques may be used to ensure the secrecy of the initialization of the encryption keys in the ATM. Message Authentication Code (MAC) or Partial MAC may also be used to ensure messages have not been tampered with while in transit between the ATM and the financial network.
There are various methods by which criminals attempt to defraud the system. Card skimming or card cloning involves the installation of a magnetic card reader over the real ATM's card slot, which is not easily detectable. The devices used are smaller than a deck of cards, and are used in association with a wireless surveillance camera or a digital camera that is hidden to observe the user's PIN. Card data is then cloned onto a second card and the criminal attempts a standard cash withdrawal. The availability of low-cost commodity wireless cameras and card readers has made it a relatively simple form of fraud, with comparatively low risk to the fraudsters. Criminals tend to attach skimming devices either late at night or early in the morning, and during periods of low traffic. Skimming devices are usually attached for a few hours only because of battery life in the camera. It is estimated that globally, financial institutions are losing over a billion dollars annually to card skimming.
Customers count on ATM security, but with ATM skimming on the rise, customer confidence is threatened. 67% of U.S. adults who use banking ATMs would be likely to switch institutions after an instance of ATM fraud or data breach. It is essential that financial institutions take corrective measures to ensure banking security.
Rules are usually set by the government or ATM operating body that dictate what happens when integrity systems fail. Depending on the jurisdiction, a bank may or may not be liable when an attempt is made to dispense a customer's money from an ATM and the money either gets outside of the ATM's vault, or was exposed in a non-secure fashion, or they are unable to determine the state of the money after a failed transaction.
In an attempt to stop these practices, countermeasures against card cloning have been developed by the banking industry, in particular by the use of smart cards which cannot easily be copied or spoofed by unauthenticated devices, and by attempting to make the outside of their ATMs tamper evident. Older chip-card security systems include the French Carte Bleue, Visa Cash, Mondex, Blue from American Express1 and EMV '96 or EMV 3.11. The most actively developed form of smart card security in the industry today is known as EMV 2000 or EMV 4.x.
EMV is widely used in the UK (Chip and PIN) and other parts of Europe, but when it is not available in a specific area, ATMs must fallback to using the easy-to-copy magnetic stripe to perform transactions. This fallback behavior can be exploited. Card cloning and skimming can be detected by the implementation of magnetic card reader heads and firmware that can read a signature embedded in all magnetic stripes during the card production process. This signature known as a “MagnePrint” or “BluPrint” can be used in conjunction with common two factor authentication schemes utilized in ATM, debit/retail point-of-sale and prepaid card applications.
Another ATM fraud issue is ATM card theft which includes credit card trapping and debit card trapping at ATMs. Originating in South America this type of ATM fraud has spread globally. Although somewhat replaced in terms of volume by ATM skimming incidents, a re-emergence of card trapping has been noticed in regions such as Europe where EMV Chip and PIN cards have increased in circulation.
A Lebanese loop is a device used to commit fraud and identity theft by exploiting automated teller machines (ATMs). Its name comes from its regular use amongst Lebanese financial crime perpetrators, although it has now spread to various other international criminal groups. The Lebanese loop is becoming one of the simplest and most widespread forms used to perpetrate ATM fraud by retaining the user's card. In their simplest form, Lebanese loops consist of a strip or sleeve of metal or plastic (even something as simple as a strip of video cassette tape) that is inserted into the ATM's card slot. When the victim inserts their ATM card, the loop is sufficiently long enough for the card to be fully drawn into the machine and read. The victim then enters their PIN as normal, and requests the funds. The ATM then tries to eject the card, but a “lip” folded at the end of the loop prevents the card from being ejected. The machine senses that the card has not been ejected, and draws the card back into the machine. The cash drawer does not open, and the money that has been counted is retained by the machine. In most cases, the victim's account is not debited. The victim believes the machine has malfunctioned or genuinely retained their card. In some cases, the fraudsters attach a small camera to the ATM to record the victim entering their PIN. The video from this camera is then transmitted to the fraudsters, who may be waiting near the machine and viewing the video on a laptop computer meaning they need not approach the victim directly. There have been cases where a fake keypad is fitted to the machine over the top of the real one, and this records the PINs entered. Once the victim has left the ATM, the perpetrator retrieves the loop and the trapped card, and uses it, along with their PIN, to withdraw cash from the victim's account.
There are different types of cameras used at locations for security purposes. One type is expensive, and does video analytics itself, or is combined with an expensive encoder attached to the camera (the embedded video analytics automatically monitor the video by watching for motion detection, object recognition and many other security threats). The other is much less expensive and just takes video, from which images can be extracted from every set time period. In both cases, the cameras run continuously.
Various approaches are currently used to address the problem of ATM fraud.
Diebold sell ATM machines. Their card-skimming technology includes ATM card-reader security designed to deter skimmer attachment, an alert system that warns bank personnel thieves have attached a skimming device to an ATM and an electromagnetic field that interferes with a skimmer's ability to capture a card's magnetic-stripe data.
Diebold's monitoring center also issues real-time e-mail alerts and text messages warning bank employees of skimming attacks.
Customers have to buy their equipment; therefore, it is not a solution for installed base.
ADT has CPK+ (Card Protection Kit) technology, an advanced anti-skimming protective device installed inside the ATM near the ATM's card reader. CPK+helps prevent the skimming of card data by emitting an electromagnetic field to interrupt the operation of an illegal card-reader head, without interrupting the customer transaction or the operation of most ATMs. They also have Surface Detection Kit (SDK); the SDK sensor helps detect foreign devices placed near or over the ATM card-entry slot, whether made of plastic, paper, iron or wood. Upon detection, it relays output signals, triggering silent alarms for monitoring center response, or to coordinate DVR surveillance sequencing of skimming activities.
ADT Anti-Skim sensing devices can be integrated with ATM or vestibule surveillance DVRs for video documentation and sequencing of skimming activities and corresponding ATM customer transactions.
ADT also has Monitoring Centers to monitor the ATM security program, and the customer can receive real-time notification of ATM skimming occurrences and law enforcement or security can be dispatched to review ATMs in alarm or remove detected skimming devices.
ATM Secure has a product Shadow Shield-ECS which offers the ability to provide an electronic shield in the vicinity of the card reader, thus providing a jamming protection shield. This prevents any card reading-skimming device from collecting data, when placed within a 100 mm radius of the ATMs card reader. In addition to this, Shadow Shield-ECS transmits a signal that is designed to confuse, and corrupt data collected by an attached skimmer.
They also have SED-E-field which provides an electronic sensing area around the ATM card slot, and can detect the presence of foreign objects like card skimming devices. Once detected, the SED-E-field can send an alarm signal to the security system, alerting of the detection.
Wincor Nixdorf sells ATM machines. They have increased even further the security in and around ATMs with the software solution ProView for the remote monitoring of self-service banking systems. Monitoring of anti-skimming modules has now been integrated into the bank machine. Anti-skimming modules are equipped with special sensors that check the area around the card insertion point for illicitly installed attachments. If such a module detects anything suspicious, it sends an “event” to ProView, which immediately initiates a variety of protective measures: for instance, it can activate a camera, photograph the perpetrator, take the ATM offline and generate a report to the service provider. If the camera monitoring an ATM fails, ProView can also take the machine offline.
They also have an anti-skimming mechanism, which is a plastic insert that can be mounted in the card reader slot. The shape of the special insert is designed to prevent tampering with skimming mechanisms but, at the same time, does not restrict ATM usage. The anti-skimming mechanism is equipped with security technology that puts the machine out of service as soon as the insert is destroyed, or the machine removed by force.
Customers have to buy their equipment; therefore, it is not a solution for installed base.
Jitter technology works via a stop start or jitter motion inside the card drive specifically designed to distort the magnetic stripe details should they be copied onto a foreign card reader inserted into the ATM.
Video Analytics, also known as IVS (Intelligent Video Surveillance) is a new emerging market for security allowing its users to easily monitor and secure areas with security cameras. With this new state of the art technology, businesses can easily monitor places of interest with sophisticated software that makes detecting threats or unwanted visitors simple and effective.
Intelligent Video Surveillance consists of algorithms that detect movement or changes in live and recorded video to see whether the movement or changes mean a possible threat is about to occur or occurring. These algorithms work by examining each pixel of the video and putting together all the pixel changes. If many pixels are changing in one area and that area is moving in a direction, the software considers this to be motion. Depending on the policies and alerts that have been setup, the bank will be notified of this motion. Other actions can be automatically taken by the as motion tracking which follows the motion until it is no longer detected. It can include Loitering Detection, Queue Length Monitoring and Facial Detection, among other things.
There are various problems with current solutions. Jitter is a security feature, but it helps only for simple skimmers. With motorized skimmers or extended skimmers, only a sensory solution will offer protection because magnetic stripe data still can be read.
Sensor detection does not work well, because it can be set off by a customer's electronic device like a cell phone or iPod.
New video cameras are very expensive, and can be prohibitive from a cost point of view given the number of ATMs that would have to be fitted with the cameras.
No current solution targets cash harvesting, which occurs when the thieves take the money out using the fake cards. No current solution can warn of skimmer installation.
US patent application no. 2008/0303902 describes a system for collecting video data and transactional data and correlating the two. However, this system is bandwidth intensive because the video data is processed along with the transactional data, and is thus not suitable for large-scale systems.